Ransomware Group Silentransomgroup Claims Attack on New York Law Firm Morrison Cohen

Key points

• Threat Vectr's own leak-site tracking has recorded 102 claimed victims for Silentransomgroup since 2 September 2025, with 20 claims posted in the past 30 days.
• Silentransomgroup listed Morrison Cohen LLP, a New York-based law firm, on its dark-web leak site on 26 October 2026, according to monitoring service Ransomware.live.
• Morrison Cohen has not publicly confirmed any incident, and the claim could not be independently verified at publication time.
• Law firms are high-value targets because they hold privileged client communications, financial records and sensitive litigation files.

Who is Silentransomgroup?

Silentransomgroup is a ransomware operation, meaning a criminal business that breaks into companies, locks or steals their files, and demands payment to restore access or to withhold publication of stolen data. The gang runs a so-called leak site on the dark web, a hidden part of the internet not accessible through normal browsers, where it names victims it claims to have attacked. Naming a company publicly is a pressure tactic designed to embarrass the target and push it toward paying.

Threat Vectr's own tracking of the group's leak site puts its total claimed victim count at 102 organisations since 3 September 2025, across three sectors, with business services firms appearing most often on the list. Twenty of those claims were posted in the past 30 days alone, a pace that suggests the group is either very active or is batching older intrusions for publication.

What did the group claim?

The listing, first observed by Ransomware.live on 26 October 2026, names Morrison Cohen LLP, a law firm headquartered in New York City whose practice areas include corporate law, litigation, and white-collar defence. That description is taken from the group's own post and should be treated with caution: ransomware gangs write these listings to pressure victims, and claims are sometimes exaggerated or false.

No ransom figure appeared in the public portion of the listing. The group has not detailed what categories of data it purportedly holds.

Morrison Cohen has made no public statement about the claim. No confirmation exists from any official or regulatory source.

Why does this matter for law firm clients?

Law firms hold some of the most sensitive documents in commercial life: merger negotiations, litigation strategy, personal financial disclosures, and correspondence that is legally privileged. A successful intrusion at any firm that handles those materials carries real risk for clients, not just the firm itself.

Clients whose matters Morrison Cohen handles should treat the period while this claim is unresolved as a prompt to be cautious. Watch for phishing emails, which are fake messages designed to trick you into handing over passwords or clicking malicious links, that use the firm's name or reference a supposed data breach. Scam callers sometimes impersonate law firms or breach-notification services in the days after a claim goes public, so be sceptical of any unsolicited call offering "breach compensation" or asking you to verify personal details. If you reuse a password across accounts, change it on any account that shares credentials with services the firm provides.

None of those steps require waiting for confirmation. They are sensible precautions whenever a company you deal with appears in a ransomware listing, verified or not.

The volume here is the story. Twenty claims in a single month from one group, concentrated in business services, is a pattern worth watching.